Skip to content
Book a demo Start free trial

Business Associate Agreement

Version 2026-11 · Effective November 1, 2026 · Print or save as PDF

This Business Associate Agreement ("BAA") is between the Customer that subscribes to Dentrova ("Covered Entity") and Software Solution LA ("Business Associate"). It forms part of the Dentrova Terms of Service and takes effect when the Covered Entity's authorized representative accepts it during sign-up or in the Service. It is intended to satisfy 45 CFR 164.308(b), 164.314(a) and 164.504(e). Capitalized terms not defined here have the meanings given in the HIPAA Rules.

1. Definitions

  • "HIPAA Rules" means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Parts 160 and 164, as amended, including by the HITECH Act.
  • "Protected Health Information" or "PHI" has the meaning in 45 CFR 160.103, limited to information Business Associate creates, receives, maintains or transmits on behalf of Covered Entity through the Service; it includes Electronic PHI.
  • "Breach", "Security Incident", "Subcontractor", "Unsecured PHI", "Individual", "Required by Law" and "Secretary" have the meanings in 45 CFR 160.103, 164.304 and 164.402.
  • "Service" means the Dentrova subscription service and related support.

2. Obligations of Business Associate

Business Associate will:

  1. not use or disclose PHI other than as permitted or required by this BAA or as Required by Law;
  2. use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 CFR Part 164 (the Security Rule) for Electronic PHI, to prevent use or disclosure of PHI other than as this BAA provides;
  3. report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including any Breach of Unsecured PHI as required by 45 CFR 164.410, and any Security Incident of which it becomes aware, as set out in Section 4;
  4. in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions, conditions and requirements that apply to Business Associate;
  5. make PHI in a Designated Record Set available to Covered Entity within ten (10) business days of a request, so Covered Entity can meet 45 CFR 164.524 (the Service also lets Covered Entity export a patient's record directly at any time);
  6. make amendments to PHI in a Designated Record Set as directed by Covered Entity under 45 CFR 164.526 (Covered Entity can make amendments directly in the Service);
  7. maintain and make available, within ten (10) business days of a request, the information required for Covered Entity to provide an accounting of disclosures under 45 CFR 164.528;
  8. to the extent Business Associate carries out an obligation of Covered Entity under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Covered Entity in performing that obligation;
  9. make its internal practices, books and records relating to PHI available to the Secretary for determining compliance with the HIPAA Rules;
  10. request, use and disclose only the minimum necessary PHI, in accordance with 45 CFR 164.502(b) and 164.514(d);
  11. store and process PHI only in data centers located in the United States;
  12. train its workforce members who have access to PHI on the HIPAA Rules, and apply sanctions to workforce members who violate them.

3. Permitted uses and disclosures

  1. Business Associate may use and disclose PHI as necessary to provide the Service to Covered Entity under the Terms of Service, including transmitting transactions Covered Entity initiates to its clearinghouse, payers, laboratories and other parties Covered Entity chooses.
  2. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities, and may disclose PHI for those purposes if the disclosure is Required by Law, or Business Associate obtains reasonable assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any instance in which the confidentiality of the information has been breached.
  3. Business Associate may de-identify PHI in accordance with 45 CFR 164.514(a)–(c) only to operate, secure and improve the Service, and will not attempt to re-identify it.
  4. Business Associate will not sell PHI, use or disclose PHI for marketing, or use PHI to train machine-learning or artificial-intelligence models.
  5. Business Associate will not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except for the uses in paragraphs 2 and 3.

4. Reporting of Breaches and Security Incidents

  1. Breaches. Business Associate will notify Covered Entity of a Breach of Unsecured PHI without unreasonable delay and in no case later than ten (10) calendar days after discovery (as defined in 45 CFR 164.410(a)(2)). The notice will include, to the extent known, the identification of each Individual affected, a description of what happened, the dates of the Breach and of discovery, the types of PHI involved, the steps Business Associate is taking to investigate, mitigate harm and prevent recurrence, and a contact person. Business Associate will supplement the notice as more information becomes available.
  2. Security Incidents. Business Associate will report successful Security Incidents within the same period. The parties agree that this Section is notice of the ongoing existence of unsuccessful Security Incidents — such as pings, port scans, blocked sign-in attempts and denial-of-service attempts that do not result in unauthorized access, use or disclosure of PHI — for which no further report is required.
  3. Mitigation and cost. Business Associate will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure in violation of this BAA. Where a Breach results from Business Associate's failure to comply with this BAA, Business Associate will reimburse Covered Entity's reasonable costs of notifying Individuals and providing credit monitoring where appropriate, subject to the limits agreed in the Terms of Service or order form.

5. Obligations of Covered Entity

  1. Covered Entity will notify Business Associate of any limitation in its Notice of Privacy Practices, any change in or revocation of an Individual's permission, and any restriction on use or disclosure Covered Entity has agreed to under 45 CFR 164.522, to the extent it affects Business Associate's use or disclosure of PHI.
  2. Covered Entity will not ask Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity.
  3. Covered Entity is responsible for configuring the Service's access roles, two-step verification policy and record retention settings appropriately for its workforce and its state's requirements.

6. Term and termination

  1. Term. This BAA runs from its effective date until the Terms of Service end and all PHI has been returned or destroyed as set out below.
  2. Termination for cause. If either party determines that the other has violated a material term of this BAA, it may give the other party written notice and thirty (30) days to cure; if the violation is not cured, it may terminate this BAA and the Terms of Service.
  3. Return or destruction. When the Terms of Service end, Business Associate will keep the PHI available to Covered Entity for export for 90 days, and will then destroy all PHI it maintains in any form, including in the possession of its Subcontractors, and retain no copies, except that encrypted backups are destroyed on their normal rotation (no more than 35 days). Business Associate will confirm the destruction in writing on request. If return or destruction is infeasible, Business Associate will extend the protections of this BAA to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it maintains the PHI.

7. Miscellaneous

  1. Regulatory references. A reference to a section of the HIPAA Rules means the section as in effect or as amended.
  2. Amendment. The parties will amend this BAA as necessary to comply with changes in the HIPAA Rules. Business Associate may publish an updated version reflecting such changes with at least 30 days' notice.
  3. Survival. Business Associate's obligations under Section 6.3 survive termination.
  4. Interpretation. Any ambiguity is resolved in favor of a meaning that permits compliance with the HIPAA Rules. If this BAA conflicts with the Terms of Service or an order form on the handling of PHI, this BAA controls.
  5. No third-party beneficiaries. Nothing in this BAA gives any rights to anyone other than the parties.
  6. Contact. Notices under this BAA go to the account owner's email for Covered Entity, and to privacy@softwaresolutionla.com and Software Solution LA, Arizona, USA for Business Associate.